Unusual Kerberos Client Process

[rule]
description = """
Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only native system
process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
"""
id = "b5c91c3e-9d2d-4df6-afb7-c9d236b5ebe2"
license = "Elastic License v2"
name = "Unusual Kerberos Client Process"
os_list = ["windows"]
version = "1.0.32"

query = '''
sequence by process.entity_id with maxspan=1m
 [any where user.id like ("S-1-5-21*", "S-1-12-*") and
  (
   (event.category =="library" and dll.name : ("System.DirectoryServices.*.dll", "Wldap32.dll")) or
   (event.category in ("network", "dns") and dns.question.name : "_ldap._tcp.*")
  )]
 [network where destination.port == 88 and source.port >= 49152 and
  network.direction == "egress" and network.transport == "tcp" and
  not destination.address : ("127.*", "::1", "66.64.*") and
  not process.executable : 
         ("?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe",
          "?:\\Program Files\\Microsoft Azure Active Directory Connect\\AzureADConnect.exe",
          "?:\\Program Files (x86)\\GalacticAgent\\bin\\GalacticScan.exe",
          "?:\\Xelis Dental Trainer\\Bin-x64\\XelisDental.exe")]
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.16.0"